Android Security

Enrollment uses clear-text UDP and ws://. Run it only on a trusted local development network.

• Guard initialization and scanner access with the app’s developer-build flag.
• Keep remote tools deny-all outside developer builds.
• Start with read-only tool access.
• Do not add Bluetooth, location, contacts, photos, or an app camera permission for Ansight enrollment.
• Google Code Scanner acquires the QR without a host-app CAMERA request.
• Clear app data or revoke the registration through the host when a test device should no longer reconnect.
• Keep cellular host connections disabled unless the workflow intentionally uses mobile data or a personal hotspot.
• Keep unattended provisioning disabled outside a trusted test runner, and never log its one-use bearer payload.
• Treat crash messages, traces, breadcrumbs, and metadata as sensitive. Disable crash capture or handoff when policy requires it.

The SDK stores its random installation id and enrollment state in app-private preferences; no connection JSON belongs in source control or build resources.

Crash reports are also bounded and stored in app-private files until delivery or expiry. See Crash Capture for retention and data-minimization guidance.